Unencrypted NameID

[Cantor, Scott]

>     According to  CustomNameIDGenerationConfiguration, I followed the
> steps in General Procedure and uncommented out the code for the SAML
> 2.0 Email Format Examples, I included that in my last message.

And I gave you a detailed answer.

> The metadata is
> asking for urn:oasis:names:tc:SAML:2.0:nameid-format:transient Do they
> need to match?

Does what need to match? The metadata is asking for transient. Therefore, the IdP will generate a transient ID, or if it can't do that (if you commented out that capability, for example), it will omit a NameID entirely. That's it. There is nothing you can do to change that behavior. It's by design, as intended, etc.

If you're trying to configure the IdP to use a different type of NameID, you need an SP that actually wants that, or you need to manipulate the testshib metadata to omit NameIDFormat or to contain some other format. The testshib SP won't care. That metadata is probably not what it should be if it's actually including NameIDFormat to begin with.

>  The metadata was generated by the SP so I'm thinking the
> format has to remain as they sent it, is that true?

NameIDFormat is almost never seen in "real" metadata without being misused. In testshib's case, it's pretty much just wrong, testshib doesn't care what you give it, so it oughtn't to have anything specific in its metadata. Many commercial SPs do want somethign specific, or think they do, but won't support metadata or won't include any formats in their metadata. And some don't care but actually enuemerate all sorts of formats.

Mostly you set NameIDFormat locally in some local copy of metadata you had to create or manipulate to make something work, and then you set it to what you need it to be to drive the IdP to generate what the SP expects.

>     Please correct me if I'm wrong, but I need to make changes in saml-
> nameid.xml, and possibly saml-nameid.properties right?

If you want to generate a custom NameID, the documentation tells you what to put in saml-nameid.xml and it tells you in no uncertain terms not to touch saml-nameid.properties.

None of that *matters* if the metadata is telling the IdP to do something different.

> I'm digesting every
> document I can find, but few provide practical examples, they're all running
> at a high level.

The wiki has absolutely explicit examples for every NameID use case we support.
 
-- Scott